Carnival Cruise Data Breach Exposes Millions of Customers’ Personal Information

Cybersecuritynews •Guru Baran • May 28, 2026

Carnival Corporation, the world’s largest cruise company and parent of Carnival Cruise Line, has begun notifying customers of a significant cybersecurity breach that exposed sensitive personal data after a threat actor successfully used social engineering to compromise an employee account. The company’s IT security team first detected unauthorized activity on April 14, 2026, after an […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Carnival Corporation Data Breach Affects Nearly 6 Million Customers Carnival Corporation reported a significant data breach affecting approximately 6 million customers due to a social engineering attack on an employee's account. The breach was detected on April 14, 2026, when unauthorized activity was identified. The attackers, linked to the ShinyHunters group, reportedly accessed sensitive personal information including names, addresses, email addresses, phone numbers, dates of birth, and government-issued identification numbers. Carnival began notifying affected individuals on May 27, 2026, offering two years of complimentary credit monitoring through TransUnion. The company is enhancing its security measures and has engaged third-party experts for further investigation. The breach is part of a larger trend of cyberattacks targeting various organizations, with ShinyHunters known for previous high-profile incidents. Legal actions are being pursued against Carnival for alleged failures in timely notification. 57 sources 69

Carnival Cruise Data Breach Exposes Millions of Customers’ Personal Information

The full story

Extracted Entities

Attack Types (1)

Companies (2)